Preventing Broken Object Level Authorisation in ASP.NET Core APIs
An authenticated user calls your API with a valid access token. The token contains the right role and the endpoint requires authorisation. Everything appears secure. The user then changes /claims/8d61
